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WLAN as a logical SGSN for WLAN-UMTS interworking. 



The drawback of the UMTS (Universal Mobile Telecommunications System) network is high 
cost of spectrum and low data rates as compared to WLANs (Wireless Local Area Networks). It 
is thus advantageous to complement UMTS with unlicensed band, high data rate WLANS such as 
IEEE 802.1 1 and ETSI Hiperlan2 in order to save UMTS radio resources and increase the 
efficiency of the UMTS RAN (Radio Access Network). The invention proposes an architecture 
where the WLAN interacts with the UMTS network through the intra-PLMN backbone over the 
Gn interface. 

A number of architectures are possible to interwork between the WLAN coverage area and other 
radio access technologies (RATs) such as UMTS. However here a novel approach is presented as 
it helps to complement the UMTS network by including the WLAN gateway in the intra-PLMN 
backbone. The advantage is that the QOS negotiation, mobility, AAA procedures of the 3G 
network are completely re-used and the 3G operator retains tight control over his customer base. 
The ideas in this invention can work with any system (GPRS/CDMA 2000) that needs to 
interwork with WLANs. 



Ref [1] 3GPP TS 25.401: "UTRAN Overall Description". 

Ref [2]: 3GPP TS 23.060: "General Packet Radio Service (GPRS), Service description, Stage 2". 

Ref [3]: 3GPP TS 24.008: "Mobile radio interface layer 3 specification Core Network Protocols 
Stage 3". 



Ref [5]: 3GPP TS 25.133: Requirements for Support of Radio Resource Management (FDD)". 

Ref [6]: 3G TS 23.003: "Numbering, addressing and identification". 

Ref [7]: Thomson Multimedia Disclosure-" Registration of the WLAN as a UMTS 
routing area for WLAN - UMTS interworking", Shaily Verma, Charlie Wang. 
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RAU 

RNC 

SGSN 

UMTS 

WLAN 



Routing Area Update 

Radio Network Controller 

Serving GPRS Support Node 

Universal Mobile Telecommunications System 

Wireless Local Area Network 



UMTS - WLAN interworking architecture 

The context of the present invention is the UMTS and WLAN (802.1 l(a, b, e, g) and 
HCPERLAN2) wireless network. The 3G UMTS mobile communicates with the radio access 
network (RAN) comprising of the Node B and Radio Network Controller (RNC). The RAN in 
turn is attached to the Core Network (CN) comprising of the SGSN (packet based services), MSC 
(circuit based services) and GGSN (gateway to other PLMNs). 



Figure 1: Tight coupling model for WLAN-3G interworking (logical SGSN) 

In Figure 1, the WLAN interworking function (IWF) bypasses the RNC and connects to the 
SGSN (assuming PS services). The GGSN takes care of the mobility at the IP layer, but the IWF 
will need to communicate with the SGSN to provide the mobility for the handoff between the two 
physical layer interfaces. This can be achieved by implementing the Gn interface between the 
IWF and the SGSN as shown in Figure 2 and 3. The 3G SGSN then sees the IWF as a logical 
SGSN. 
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Figure 2: User plane stack for IWF as Logical SGSN 
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Figure 3: Control plane stack for IWF as Logical SGSN 

The SGSN-GGSN part may become a bottleneck in handling high data rate WLAN hotspots. In 
that case another option is that the GTP tunnel between GGSN and IWF is used only for 
downlink traffic coming at the GGSN for the UE. For all other traffic, the WLAN provides a 
common Internet access to the UE. This shall keep the traffic through the SGSN-GGSN lower. 
Mobility 

1. UMTS to WLAN Entry 

We assume that the terminal can detect the entry into a WLAN. If the UMTS SGSN covers one 
RA and the WLAN coverage area is another RA, as per [7], the WLAN IWF can broadcast the 
new RAI (pre-allocated by the UMTS network) or send it at the time the UE registers with the 
WLAN. By comparing the RAI stored in the UE's GMM context with the RAI received from the 
IWF, the UE detects that an RA update (inter-SGSN) needs to be performed. The procedure is 
described in [2] and is shown in Figure 4. For an Inter-SGSN RA Update, the new SGSN (IWF) 
typically informs the HLR of the change of SGSN by sending Update Location (SGSN Number, 
SGSN Address, and IMSI) to the HLR. Three scenarios are possible: 

Case 1: The IWF can have the Gr interface with the HLR in which case all the steps in Figure 4 
as per [2] can be followed. 

Case 2: The new SGSN (IWF) shall not implement the Gr interface towards HLR and so step 6 
of sending location update to the HLR by the IWF along with steps 7, 8, 9, 10, 1 1,12, 15 shall be 
skipped. The Iu release sequence in 7a shall happen when the UE sends an explicit signaling 
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connection release to the UTRAN upon being validated by Ae old SGSN in step 2 or 2a 
depending on the PMM state of the UE. Since the GGSN is updated with the new SGSN (IWF) 
the UE is now registered with in step 5, all the uplink and downlink packets shall be sent 
conveniently and the skipping of HLR location update shall not cause any problems. 



Case 3: IP based Diameter authentication from the HSS may be implemented between an IWF 
and HLR in the f uture and standard p rocedures for inter-SGSN reloc ation can tr anspire. 
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Figure 4: Routing area change from UMTS SGSN to IWF (pseudo SGSN) 
2. WLAN to UMTS Entry 
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Upon re-entry into the UMTS network the UE shall again perform an inter-SGSN routing area 
update and repeat the procedures shown in Figure 4 except that this time the new SGSN shall be 
the UMTS SGSN while the old SGSN shall be the IWR 3G security procedures should be 
implemented to re-validate the UB when it goes back to the UMTS network. 

Again the three cases mentioned above are valid: 

Case 1: The IWF can have the Gr interface with the HLR in which case all the steps in Figure 4 
as per [2] can be followed. 

Case 2: Since while going into the WLAN, the IWF had not updated the HLR and the 
UMTS SGSN marked in its context that the MSC/VLR association and the information in 
the GGSNs and the HLR as invalid, when the MS initiates a routing area update 
procedure back to the UMTS SGSN, it triggers the MSCWLR, the GGSNs, and the HLR 
information in the UMTS SGSN to be updated/validated. 

Case 3: IP based Diameter authentication from the HSS may be implemented between an 
IWF and HLR in the future and standard procedures for inter-SGSN relocation can 
transpire. 

Security 

The IWF will implement 3G procedures to authenticate the UE. In step 2 in Figure 4, if the MS 
was in PMM-JDLE state, the IWF (new SGSN) sends an SGSN Context Request message (old 
P-TMSI, old RAI, old P-TMSI Signature) to the old SGSN to get the MM and PDP contexts for 
the MS. The old SGSN validates the old P-TMSI Signature and responds with an appropriate 
error cause if it does not match the value stored in the old SGSN. The IWF can be attached to the 
3G intra-PLMN backbone and so need not re-authenticate the UE with the HLR upon it's entering 
the WLAN if the old SGSN validates the UE. The UE in PMM-CONNECTED state entails the 
sending of a Relocation Command message to the source SKNC by the old SGSN followed by a 
Forward SRNS Context (RAB Contexts) message to the new SGSN (IWF) via the old SGSN, 
which is again a validation of the UE by the UMTS SGSN. 

However WLAN security procedures should be implemented so that the MS sends ciphered 
P-TMSI, old RAI, old P-TMSI Signature, Update Type, follow on request, Classmark, DRX 
Parameters and MS Network Capability to the IWF (new SGSN), which can then send them to 
the old 3G SGSN. 
Advantage of the invention 

The advantages of the invention are the following: 

> The advantage is that the mobility, AAA procedures of the 3G network are re-used. 

> The service provider requires only one point of attachment to serve the 3G network as 
well as the attached WLANs helping him retain tight control over his customer base in 
the WLAN as well. 

> The simple IP-based Gn interface of the SGSN shall be implemented in the IWF towards 
the SGSN making the solution scalable. As proposed in case 2 under the section on 
mobility, the other complex SGSN interfaces such as Gr (towards HLR) etc. can be 
skipped. 
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> Address is still allocated by the same GGSN while the terminal is in the WLAN. 

> The proposed solution also has the advantage that the dual GTP encapsulation as in the 
UMTS network (GGSN-SGSN and then SGSN-RNQ is avoided as only the GGSN-IWF 
encapsulation part is done in the WLAN coverage area. 

> No modifications to the existing UMTS network nodes are required for this interworking 
architecture. 

> Using the concept in [7], the RA update timer can be set to a large value upon entering 
the WLAN RA so that frequent RAUs are avoided resulting in conservation of battery. 

> WLAN radio resources shall be used in the WLAN coverage area freeing up the radio 
resources of the RAT (3G) the UE is moving into the WLAN from. 



